[lockfile-stats] Lockfile Statistics Audit — 2026-06-19

[github-actions[bot]]

Executive Summary

Snapshot of 250 compiled .lock.yml workflows in .github/workflows/ as of 2026-06-19. All 250 parsed cleanly (0 skipped). Total compiled size 29.4 MB (29,357,567 bytes), averaging 115 KB per lockfile.

Metric	Value	Δ vs 2026-06-18
Lockfiles	250	±0
Total bytes	29,357,567	-107722
Avg size	117,430 B	-431
Median size	116,713 B	-502
Total jobs	2,009	+1
Total steps	28,282	+18
Total run scripts	12,540	+13

File Size Distribution

Min 77,874 B · Median 116,713 B · Avg 117,430 B · Max 177,670 B

Bucket	Count
100-250KB	238
50-100KB	12

Largest 5 lockfiles

Workflow	Bytes
smoke-copilot-aoai-entra.lock.yml	177,670
smoke-copilot-aoai-apikey.lock.yml	177,261
smoke-claude.lock.yml	174,198
smoke-copilot.lock.yml	172,984
smoke-copilot-arm.lock.yml	164,734

Trigger Analysis

Trigger	Workflows
workflow_dispatch	242
schedule	167
pull_request	33
issues	4
issue_comment	2
push	2
workflow_run	1
discussion	1
discussion_comment	1
pull_request_review_comment	1

workflow_dispatch is near-universal (242/250); 167 are scheduled. Top combinations:

Combination	Count
schedule+workflow_dispatch	163
workflow_dispatch	49
pull_request+workflow_dispatch	26
pull_request	3
issue_comment+issues+pull_request	1
issues+schedule+workflow_dispatch	1

Safe Outputs Analysis

⚠️ Parser limitation (v1 schema): safe_output_types and discussion_categories resolved empty across the current run and every historical snapshot. The compiled lock files encode safe-output configuration in a form the v1 regex does not currently capture, so per-type safe-output counts are unavailable in this report rather than genuinely zero. This is a known schema gap flagged for a lockfile_stats_v2 bump (add safe-output + permission extraction).

Structural Characteristics

Dimension	Min	Avg	Max	Max workflow
Jobs / workflow	5	8.04	12	firewall-escape.lock.yml
Steps / workflow	76	113.13	151	smoke-copilot-aoai-apikey.lock.yml

Aggregate: 2,009 jobs, 28,282 steps, 12,540 run scripts across all lockfiles.

Timeout distribution (minutes):

Range	Count
<=5	16
6-15	122
16-30	334
31-60	283
>60	3

Permission Patterns

Top-level permissions: resolved to {} (empty mapping) for all 250 lockfiles in the v1 parser, and per-scope read/write extraction returned empty. As with safe-outputs, this reflects a v1 extraction gap rather than an absence of permission scoping in the compiled jobs — deferred to v2.

Tool & MCP Patterns

MCP server	References
github	6,656
playwright	168
sentry	96
grafana	28
ruflo	16
arxiv	6
deepwiki	6

Engine distribution:

Engine	Workflows
copilot	167
claude	64
codex	14
antigravity	1
crush	1
gemini	1
opencode	1
pi	1

The GitHub MCP server dominates (6,656 references); a long tail of agent-specific servers (playwright, sentry, grafana, arxiv, deepwiki) serves specialized workflows. The top ~30 GitHub MCP tools each appear in exactly 128 workflows, indicating a shared default GitHub toolset.

Interesting Findings

1. Copilot is the plurality engine — 167 of 250 workflows (66%), ahead of claude (64) and codex (14); six engines appear exactly once (antigravity, crush, gemini, opencode, pi).
2. Scheduled + dispatch is the dominant shape — 163 workflows pair a cron with manual dispatch, the canonical 'autonomous agent' pattern.
3. Smoke tests are the heaviest lockfiles — the 6 largest are all smoke-* workflows (≈150–178 KB), reflecting multi-engine matrix expansion.
4. A shared 128-workflow GitHub toolset — dozens of GitHub MCP read tools each appear in exactly 128 lockfiles, evidence of a common compiled default.
5. Very stable corpus day-over-day — count unchanged at 250; total bytes drifted only -107722 B (-0.37%), consistent with routine recompilation rather than structural change.

Historical Trends

Comparison against the latest prior snapshot (2026-06-18); history spans 2026-05-20 → 2026-06-19 (30 daily snapshots).

Metric	2026-06-18	2026-06-19	Δ
Lockfiles	250	250	±0
Total bytes	29,465,289	29,357,567	-107722
Avg size	117,861	117,430	-431
Total steps	28,264	28,282	+18
Total scripts	12,527	12,540	+13

Engine mix, trigger counts, timeout distribution, and MCP server usage were identical to the prior day.

Recommendations

1. Bump the analyzer to lockfile_stats_v2 to fix safe-output, discussion-category, and permission extraction — currently the report's weakest sections due to v1 regex gaps.
2. Review the 6 smoke-* lockfiles (>150 KB) for shared matrix boilerplate that could be factored into reusable includes to cut compiled size.
3. Audit the six single-use engines (antigravity, crush, gemini, opencode, pi, plus low-count codex) to confirm they are intentional experiments and not stale.
4. Validate the 3 workflows with >60 min timeouts against expected runtimes to avoid runaway-cost exposure.

---

Methodology: single-script compact JSON analysis. One cached Python analyzer (/tmp/gh-aw/cache-memory/scripts/lockfile_stats_v1.py) parsed all 250 lockfiles in one pass, emitting a compact JSON summary (<5 KB); all figures above derive from that summary and the persisted history snapshots — no per-file inspection during reasoning.

Generated by 📊 Lockfile Statistics Analysis Agent · 81.2 AIC · ⌖ 12.2 AIC · ⊞ 5K · ◷

• expires on Jun 20, 2026, 12:48 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Lockfile Statistics Analysis Agent.

A newer discussion is available at Discussion #40510.